Cryptojacking is the likely cause in this scenario. It involves malware that hijacks the resources of infected computers to mine cryptocurrency, usually without the user's knowledge. This type of attack doesn't typically degrade performance significantly or result in obvious system failures, which matches the situation described, where the machines showed no signs of degraded performance or excessive failed logins.
References =
* CompTIA Security+ SY0-701 Course Content: Cryptojacking is covered under types of malware attacks, highlighting its stealthy nature and impact on infected systems.

The correct answer is B. Code signing.
Code signing uses a digital signature to verify the authenticity and integrity of software, scripts, drivers, or compiled binaries. If a compiled binary is signed, the production environment can verify that the binary came from a trusted source and has not been modified since it was signed.
This supports integrity because any unauthorized change to the binary would invalidate the signature.
Why the other options are incorrect:
A). Input validation
Input validation helps prevent attacks such as injection, cross-site scripting, and malformed input attacks. It does not verify the integrity of compiled binaries.
C). SQL injection
SQL injection is an attack technique, not a security measure.
D). Static analysis
Static analysis reviews source code or binaries without executing them. It can help identify vulnerabilities before deployment, but it does not provide ongoing integrity verification of compiled binaries in production.
Therefore, the best answer is code signing.

Threat hunting is the correct next step because the analyst already has indicators of compromise from a cybersecurity bulletin and now needs to search the environment for evidence of those indicators. Threat hunting is proactive investigation using IOCs, threat intelligence, logs, endpoint telemetry, network data, and SIEM queries to determine whether malicious activity exists. Root cause analysis happens after an incident is confirmed and understood. A tabletop exercise is a simulated discussion used to test response readiness, not to check current compromise. A penetration test is an authorized offensive assessment and does not directly use received IOCs to determine whether systems are already affected.
Security+ treats IOC-driven investigation as a threat hunting activity.

Anair-gapped (C)system is completely isolated from unsecured networks (like the internet) and other systems, preventing any form of remote access. This is often used in highly sensitive environments such as military, nuclear, or critical infrastructure systems.
This is mentioned underDomain 3.4: Given a scenario, apply cybersecurity resilience conceptsin theCompTIA Security+ SY0-701 Exam Objectives, specifically under"Isolation (e.g., air-gapped)".
Reference: CompTIA Security+ SY0-701 Objectives, Domain 3.4 - "Cybersecurity resilience: Isolation (e.g., air-gapped)."